WordPress Vulnerability Database

Wordfence Intelligence   >   Vulnerability Database
WordPress Core
WordPress Plugins
WordPress Themes

Search All Vulnerabilities

Tip: You can search by CVE ID, software name or slug, or the researcher name. Expand to read about more advanced search options.

If you want to perform more advanced lookups, you can use keywords to further refine your search.

For example, woocommerce researcher:"chloe chamberland" would search for any vulnerabilities discovered by Chloe Chamberland in software that has WooCommerce in the title.

Keywords are added in keyword:value format. If the value contains spaces, you must enclose it in quotation marks.

You can use the following keywords to add criteria to your search:

title
Searches through the title of each vulnerability for matches.
date
Returns vulnerabilities by publication date. Use YYYY-MM-DD, YYYY-MM or YYYY format.
cvss-rating
Use low, medium, high or critical to limit the search to vulnerabilities with the specified rating.
researcher
Returns vulnerabilities credited to researchers containing the given text.
software
Returns vulnerabilities discovered in software containing the given text.
software-slug
Returns vulnerabilities discovered in software exactly matching the given slug.
software-type
Use plugin, theme or core to limit the search to the specified type of software.
By selecting “Search” you acknowledge that you have read and agree to the Wordfence Intelligence Terms and Conditions.

All Vulnerabilities

Submit Vulnerability
FV Flowplayer Video Player <= 7.5.54.7212 - Authenticated (Subscriber+) Arbitrary File Upload via 'video_url' Parameter
8.8
CVE-2026-86461
Oct 14, 2026
Researcher: Osman Hussein
SimpleForm <= 3.10.0 - Unauthenticated Privilege Escalation to wp_capabilities Mass Assignment via simpleform_wp_register
9.8
CVE-2026-104748
Oct 13, 2026
Researcher: Sebastian Albrecht (mySebbe)
Record of Consent Extension for Complianz <= 2.5 - Unauthenticated Stored Cross-Site Scripting via 'uid' Parameter
7.2
CVE-2026-107631
Oct 13, 2026
Researcher: OKISO
ShopMagic <= 4.9.0 - Unauthenticated Local File Inclusion via 'billing.first_name' Parameter
8.1
CVE-2026-103367
Oct 13, 2026
Researcher: crow
PeproDev Branches Map <= 3.0.1 - Authenticated (Contributor+) Stored Cross-Site Scripting
6.4
CVE-2025-9373
Oct 13, 2026
Researcher: Nabil Irawan
Post Export Import with Media <= 1.17.1 - Authenticated (Administrator+) PHP Object Injection via 'page_data[meta]' Parameter
7.2
CVE-2026-104764
Oct 13, 2026
Researcher: Wordfence PRISM
Meow Lightbox <= 5.6.2 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Output Buffering parser noise substitution via comment body + display_name
6.4
CVE-2026-107756
Oct 13, 2026
Researcher: crow
Mang Board <= 2.4.3 - Unauthenticated Local File Inclusion via '<mode>_type' Parameter
8.1
CVE-2026-104909
Oct 13, 2026
Researcher: Wordfence PRISM
Mang Board <= 2.4.3 - Unauthenticated Stored Cross-Site Scripting via 'user_name' Parameter
7.2
CVE-2026-107751
Oct 13, 2026
Researcher: leon figueira
Mang Board <= 2.4.3 - Authenticated (Custom+) Stored Cross-Site Scripting via 'content' Parameter
6.4
CVE-2026-104761
Oct 13, 2026
Researcher: Wordfence PRISM
LifterLMS <= 10.3.1 - Authenticated (Contributor+) Local File Inclusion via 'lifterlms_checkout' Shortcode Attributes
7.5
CVE-2026-110284
Oct 13, 2026
Researcher: Adrien Brunner
Jeg Kit for Elementor <= 3.2.19 - Missing Authorization to Authenticated (Subscriber+) Sensitive Information Exposure via 'jeg_find_author' AJAX Action
6.5
CVE-2026-103907
Oct 13, 2026
Researcher: Kuba
Appointment Booking Plugin <= 5.7.2 - Unauthenticated Authentication Bypass to Customer Account Takeover via Insufficient Verification in create_wp_user_for_customer() username_exists Fallback
7.4
CVE-2026-100163
Oct 13, 2026
Researcher: OKISO
Appointment Booking Plugin <= 5.7.3 - Insecure Direct Object Reference to Unauthenticated Sensitive Information Disclosure via 'booking[id]' and 'cart[id]' Parameters
7.5
CVE-2026-103366
Oct 13, 2026
Researcher: churchill11
Appointment Booking Plugin <= 5.7.3 - Authenticated (Subscriber+) Sensitive Information Exposure in 'first_name' Parameter Template Re-expansion
4.3
CVE-2026-103380
Oct 13, 2026
Researcher: walid213
GeoDirectory <= 2.8.190 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Dynamic Content Field-Token Substitution via Listing Title
6.4
CVE-2026-107650
Oct 13, 2026
Researcher: Adrien Brunner
GeoDirectory <= 2.8.190 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Image Title
6.4
CVE-2026-107754
Oct 13, 2026
Researcher: Sawyer
Gallery Custom Links <= 2.3.3 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Comment Author Display Name + Comment HTML Comment Body
4.9
CVE-2026-107757
Oct 13, 2026
Researcher: crow
Social Share Buttons & Analytics Plugin <= 4.5 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'response' Parameter via gs_update_with_values AJAX
6.4
CVE-2026-103369
Oct 13, 2026
Researcher: Alz
NewStatPress <= 1.4.5 - Unauthenticated Stored Cross-Site Scripting via 'urlrequested' Attribute via Query String
7.2
CVE-2026-101924
Oct 13, 2026
Researcher: zickzick2
Title CVE ID CVSS Researchers Date
FV Flowplayer Video Player <= 7.5.54.7212 - Authenticated (Subscriber+) Arbitrary File Upload via 'video_url' Parameter CVE-2026-86461 8.8 Osman Hussein October 14, 2026
SimpleForm <= 3.10.0 - Unauthenticated Privilege Escalation to wp_capabilities Mass Assignment via simpleform_wp_register CVE-2026-104748 9.8 Sebastian Albrecht (mySebbe) October 13, 2026
Record of Consent Extension for Complianz <= 2.5 - Unauthenticated Stored Cross-Site Scripting via 'uid' Parameter CVE-2026-107631 7.2 OKISO October 13, 2026
ShopMagic <= 4.9.0 - Unauthenticated Local File Inclusion via 'billing.first_name' Parameter CVE-2026-103367 8.1 crow October 13, 2026
PeproDev Branches Map <= 3.0.1 - Authenticated (Contributor+) Stored Cross-Site Scripting CVE-2025-9373 6.4 Nabil Irawan October 13, 2026
Post Export Import with Media <= 1.17.1 - Authenticated (Administrator+) PHP Object Injection via 'page_data[meta]' Parameter CVE-2026-104764 7.2 Wordfence PRISM October 13, 2026
Meow Lightbox <= 5.6.2 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Output Buffering parser noise substitution via comment body + display_name CVE-2026-107756 6.4 crow October 13, 2026
Mang Board <= 2.4.3 - Unauthenticated Local File Inclusion via '<mode>_type' Parameter CVE-2026-104909 8.1 Wordfence PRISM October 13, 2026
Mang Board <= 2.4.3 - Unauthenticated Stored Cross-Site Scripting via 'user_name' Parameter CVE-2026-107751 7.2 leon figueira October 13, 2026
Mang Board <= 2.4.3 - Authenticated (Custom+) Stored Cross-Site Scripting via 'content' Parameter CVE-2026-104761 6.4 Wordfence PRISM October 13, 2026
LifterLMS <= 10.3.1 - Authenticated (Contributor+) Local File Inclusion via 'lifterlms_checkout' Shortcode Attributes CVE-2026-110284 7.5 Adrien Brunner October 13, 2026
Jeg Kit for Elementor <= 3.2.19 - Missing Authorization to Authenticated (Subscriber+) Sensitive Information Exposure via 'jeg_find_author' AJAX Action CVE-2026-103907 6.5 Kuba October 13, 2026
Appointment Booking Plugin <= 5.7.2 - Unauthenticated Authentication Bypass to Customer Account Takeover via Insufficient Verification in create_wp_user_for_customer() username_exists Fallback CVE-2026-100163 7.4 OKISO October 13, 2026
Appointment Booking Plugin <= 5.7.3 - Insecure Direct Object Reference to Unauthenticated Sensitive Information Disclosure via 'booking[id]' and 'cart[id]' Parameters CVE-2026-103366 7.5 churchill11 October 13, 2026
Appointment Booking Plugin <= 5.7.3 - Authenticated (Subscriber+) Sensitive Information Exposure in 'first_name' Parameter Template Re-expansion CVE-2026-103380 4.3 walid213 October 13, 2026
GeoDirectory <= 2.8.190 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Dynamic Content Field-Token Substitution via Listing Title CVE-2026-107650 6.4 Adrien Brunner October 13, 2026
GeoDirectory <= 2.8.190 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Image Title CVE-2026-107754 6.4 Sawyer October 13, 2026
Gallery Custom Links <= 2.3.3 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Comment Author Display Name + Comment HTML Comment Body CVE-2026-107757 4.9 crow October 13, 2026
Social Share Buttons & Analytics Plugin <= 4.5 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'response' Parameter via gs_update_with_values AJAX CVE-2026-103369 6.4 Alz October 13, 2026
NewStatPress <= 1.4.5 - Unauthenticated Stored Cross-Site Scripting via 'urlrequested' Attribute via Query String CVE-2026-101924 7.2 zickzick2 October 13, 2026
Submit Vulnerability

Researcher Hall of Fame (Past 30 days)

View All
Rank Name
Vulnerabilities since Sep 14, 2026
Vulns
1 Ananda Dhakal 184
2 Wordfence PRISM 70
3 Intrudify 47
4 nh4tvd 36
5 João Pedro S Alcântara 33
6 Jakub Herman 31
7 Karthik Ramakrishnan 31
8 Artus KG 29
9 Naoki Kawahigashi 28
10 Enrico Marcolini 24
11 Bonds 22
12 Rafie Muhammad 22
13 daroo 22
14 Iñigo Sánchez Enciso 21
15 Erwan LR 21
16 Pablo González Pérez 21
17 Francisco José Ramírez Vicente 21
18 neurotx 21
19 Supakiad S. (m3ez) 19
20 Peter Tang 19

Did you know Wordfence Intelligence provides free personal and commercial API access to our comprehensive WordPress vulnerability database, along with a free webhook integration to stay on top of the latest vulnerabilities added and updated in the database? Get started today!

Learn more

Want to get notified of the latest vulnerabilities that may affect your WordPress site?
Install Wordfence on your site today to get notified immediately if your site is affected by a vulnerability that has been added to our database.

Get Wordfence

The Wordfence Intelligence WordPress vulnerability database is completely free to access and query via API. Please review the documentation on how to access and consume the vulnerability data via API.

Documentation